[LTP] [PATCH] Revert "pkey01: Adding test for PKEY_DISABLE_EXECUTE"
Petr Vorel
pvorel@suse.cz
Fri Nov 15 19:58:19 CET 2024
Hi Li, Martin,
> Sorry, I forgot to CC Li in the patch.
> On 15. 11. 24 16:44, Martin Doucha wrote:
> > This reverts commit d2b8a476c29d52c484b387454082bbc906b0b4f8.
> > Remove the PKEY_DISABLE_EXECUTE subtest. The function_size() code
> > is broken in a way that I cannot easily fix. The function tries
> > to calculate the size of a function by finding the first RET
> > instruction. However, in 32bit LTP builds, the code gets compiled
> > to this:
> > 0804b690 <function_size>:
> > 804b690: 8b 4c 24 04 mov 0x4(%esp),%ecx
> > 804b694: 0f b6 01 movzbl (%ecx),%eax
> > 804b697: 83 c0 3e add $0x3e,%eax
> > 804b69a: 3c 01 cmp $0x1,%al
> > 804b69c: 76 1a jbe 804b6b8 <function_size+0x28>
> > 804b69e: 89 c8 mov %ecx,%eax
> > 804b6a0: 83 c0 01 add $0x1,%eax
> > 804b6a3: 0f b6 10 movzbl (%eax),%edx
> > 804b6a6: 83 c2 3e add $0x3e,%edx
> > 804b6a9: 80 fa 01 cmp $0x1,%dl
> > 804b6ac: 77 f2 ja 804b6a0 <function_size+0x10>
> > 804b6ae: 29 c8 sub %ecx,%eax
> > 804b6b0: 83 c0 10 add $0x10,%eax
> > 804b6b3: c3 ret
> > 804b6b4: 8d 74 26 00 lea 0x0(%esi,%eiz,1),%esi
> > 804b6b8: b8 10 00 00 00 mov $0x10,%eax
> > 804b6bd: c3 ret
> > 804b6be: 66 90 xchg %ax,%ax
> > If you look closely enough, you'll notice a C2 byte in add $0x3e,%edx
> > instruction on address 804b6a6. The function will assume this byte is
> > a RET instruction, return a size that's 22 bytes too short and then
> > the code execution inside the executable buffer will run past the end
> > of buffer, resulting in a segfault.
Martin, thanks a lot for debugging!
Acked-by: Petr Vorel <pvorel@suse.cz>
Other option would be to disable this test only for 32bit (keep it for 64bit).
Li, any change you could have look into it?
Kind regards,
Petr
More information about the ltp
mailing list